In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-5014.json"